One test failure:

06:42:26  Failed tests:
06:42:26  FAILED test: py3-test_pagure_flask_api_issue

@pingou Would it be possible to disable SSH-based interactions on an instance? For example, Git via SSH may not be permitted by policy due to not wanting to have SSH service (effectively shell service) active?

@ngompa that may be doable though I'd scope this in another PR

@pingou Sure, not saying do it now, but it's a good idea for later. :smile:

Only style test is failing now!

11:55:22  Failed tests:
11:55:22  FAILED test: py3-test_style

Only send a WWW-Authenticate: Basic if a user is expected to enter a standard username/password.
Because otherwise a client will ask for a username/password which won't work without local auth method.

If an OpenID Connect token is expected, the authorization header should say Authorization: Bearer <token>. So you want to not expect Basic, but instead check what type of auth header they provided, and verify that if auth_method is "local", that the auth_type is "Basic", and you have a different auth_type for token auth.
Because otherwise you may be running a base64 decode on a token that is not base64 encoded.
(You really don't want to use Basic auth for tokens)

(Do note that OpenID Connect Bearer tokens should be captured by mod-auth-openidc, so via flask.request.remote_user.)

@puiterwijk Why wouldn't Basic auth work with tokens? You'd just use them the same way you use GitLab/GitHub personal access tokens (username + token as password). I would personally expect that behavior to work and it'd be surprising if it didn't.

Yes, I expected that OIDC was covered by flask.request.remote_user (as it is currently in src.fp.o) and thus the line 20 here that checks first if remote_user was already found or not.

In that case the idea is to have them provide their username as username and the API token as password

Well, at least the test that was added didn't fail. :smile:

04:22:30  Failed tests:
04:22:30  FAILED test: py3-test_pagure_flask_ui_login
04:22:30  FAILED test: py3-test_style

@pingou Does the apache httpd config change any for this?

@ngompa I used the vagrant box to test this and it doesn't use apache but I don't think it does

If the tests pass, I'll pull this in to test and verify that claim.

This does not work on my setup. I cannot get it to prompt me for my credentials.

Note that I'm doing a setup based on the README.Fedora quickstart (from the Fedora package), only with gitolite switched out for the pagure backend.

We'll need to debug this a little more then. Did you adjust the few configuration keys needed?

HTTP_REPO_ACCESS_GITOLITE = False
ALLOW_HTTP_PUSH = True

What does git push with GIT_CURL_VERBOSE=1 show?

I had HTTP_REPO_ACCESS_GITOLITE = None, and was missing the second setting.

I added the second setting and tried again. I get this:

ngompa@opensuse-lp150-skuld-vm:~/pagure-localhost-scm/rpmdistro-repoquery> GIT_CURL_VERBOSE=1 git push
* Couldn't find host localhost.localdomain in the .netrc file; using defaults
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost.localdomain (127.0.0.1) port 80 (#0)
> GET /code/rpmdistro-repoquery.git/info/refs?service=git-receive-pack HTTP/1.1
Host: localhost.localdomain
User-Agent: git/2.16.4
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US, *;q=0.9
Pragma: no-cache
< HTTP/1.1 403 Forbidden
< Date: Fri, 08 May 2020 12:22:30 GMT
< Server: Apache
< Expires: Fri, 01 Jan 1980 00:00:00 GMT, Fri, 01 Jan 1980 00:00:00 GMT
< Pragma: no-cache, no-cache
< Cache-Control: no-cache, max-age=0, must-revalidate, no-cache, max-age=0, must-revalidate
< Content-Length: 0
< 
* Connection #0 to host localhost.localdomain left intact
fatal: unable to access 'http://localhost.localdomain/code/rpmdistro-repoquery.git/': The requested URL returned error: 403

And ALLOW_HTTP_PULL_PUSH is True?

You will actually need to change the apache config slightly. You will need to set WSGIPassAuthorization on (https://modwsgi.readthedocs.io/en/develop/configuration-directives/WSGIPassAuthorization.html), otherwise the Authorization header doesn't make it to the Python app.

And ALLOW_HTTP_PULL_PUSH is True?

I believe this is set by default, but I've set it manually now and tried again, still the same result.

You will actually need to change the apache config slightly. You will need to set WSGIPassAuthorization on (https://modwsgi.readthedocs.io/en/develop/configuration-directives/WSGIPassAuthorization.html), otherwise the Authorization header doesn't make it to the Python app.

This is already on in my Apache httpd config, though it's good to know for my nginx config work...

So this works for me now if I also drop the following lines from the apache config: https://pagure.io/pagure/blob/9ea9558cf642f945fe93868fdb9470463b652536/f/files/pagure.conf#_70-80

:thumbsup:

:thumbsup:

Let's get this in :)

:tada: